Loading threat actor…
Lunar Spider, also tracked as GOLD SWATHMORE and LunarSpider, is a Russian-speaking, financially motivated cybercriminal group associated with the development and operation of IcedID, also known as BokBot, and Latrodectus. Its activities encompass banking malware, malware delivery, and the provision of initial access to other criminal groups. Financial services organizations are among its documented targets; its operating country is not established. IcedID evolved from a banking trojan into an important access and payload-delivery mechanism for hands-on intrusions and ransomware campaigns. Around June 2020, GOLD SWATHMORE began making IcedID available to outside threat groups for ransomware operations. The group has cooperated extensively with GOLD BLACKBURN since 2018, and leaked criminal communications exposed contacts with the wider TrickBot and Conti ecosystem. These relationships distinguish its role as a malware developer and access provider from the downstream ransomware operators using its infections. Lunar Spider campaigns use phishing, malicious advertising, search-engine poisoning, tax-themed lures, and fake CAPTCHA or ClickFix social engineering to distribute malware. Observed infection chains employ obfuscated JavaScript, Windows Installer packages, and rundll32 execution to deploy Latrodectus and Brute Ratel C4. Its associated intrusion toolchain also includes Cobalt Strike and BackConnect remote-access tooling. Documented behaviors include host reconnaissance, credential theft, data exfiltration, interactive remote access, and persistence through scheduled tasks or registry-based autostart mechanisms. Defense evasion includes encrypted strings, custom packing, and sandbox checks. The group has also used Telegram to monitor fake-CAPTCHA visitors and transmit browser information.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
18 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
8 malware families Mallory has associated with this actor across public reporting.
3 additional families tracked in Mallory.
27 indicators attributed to this actor. Values are masked here and available in full in Mallory.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.